diff --git a/RELEASING.md b/RELEASING.md
index 682a725c..637cb96a 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -72,17 +72,10 @@ token](https://help.github.com/articles/creating-a-personal-access-token-for-the
     $ git checkout -b deps remotes/upstream/v$MAJOR.$MINOR.x
     ```
 
-    One day, this will be automated. In the meantime, edit the `WORKSPACE` file
-    and for every `http_archive`:
-    * Use `git ls-remote https://github.com/abc/def master` to determine the
-      commit.
-    * Download the archive and `sha256sum` it.
-    * Change `urls = ".../archive/master.zip"` to
-    `urls = ".../archive/$COMMIT.zip`.
-    * Change `strip_prefix` from `-master` to `-$COMMIT`.
-    * Add `sha256 = "$SHASUM"`.
-
-    Likewise update the `cmake/*.CMakeLists.txt` files.
+    One day, this will be more automated. In the meantime,
+    run `tools/pin_deps.py` and edit the `WORKSPACE` file accordingly.
+
+    Likewise update the `cmake/OpenCensusDeps.cmake` file.
 
     Run `tools/presubmit.sh` to test building with bazel, and follow the
     [CMake README](cmake/README.md) for CMake.
diff --git a/tools/pin_deps.py b/tools/pin_deps.py
new file mode 100755
index 00000000..857d2c90
--- /dev/null
+++ b/tools/pin_deps.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python
+'''
+This script uses the GitHub API to construct http_archive elements to be
+inserted into the WORKSPACE file.
+
+It is a fork of:
+https://github.com/abseil/federation-hello/blob/0c1ef91b9cc5aabf15a3ff15761837d1c8da93a6/head_sync.py
+'''
+import hashlib
+import json
+import urllib3
+
+HTTP_ARCHIVE_TEMPLATE = """http_archive(
+  name = "{}",
+  urls = ["{}"],  # {}
+  strip_prefix = "{}-{}",
+  sha256 = "{}",
+)"""
+
+http = urllib3.PoolManager()
+
+
+class ExternalDependency(object):
+  def workspace_rule(self):
+    raise NotImplementedError('must implement workspace_rule()')
+
+
+class GitHubProject(ExternalDependency):
+  def __init__(self, name, owner, repo):
+    self.name = name
+    self.owner = owner
+    self.repo = repo
+
+  def workspace_rule(self):
+    # https://developer.github.com/v3/repos/commits/
+    request = http.request(
+        'GET', 'https://api.github.com/repos/{}/{}/commits'.format(
+            project.owner, project.repo),
+        headers = { 'User-Agent': 'Workspace Updater' })
+    response = json.loads(request.data.decode('utf-8'))
+    commit = response[0]["sha"]
+    date = response[0]["commit"]["committer"]["date"]
+    url = 'https://github.com/{}/{}/archive/{}.zip'.format(
+        project.owner, project.repo, commit)
+    request = http.request('GET', url,
+                           headers = { 'User-Agent': 'Workspace Updater' })
+    sha256 = hashlib.sha256(request.data).hexdigest()
+    return HTTP_ARCHIVE_TEMPLATE.format(project.name, url, date, project.repo,
+                                        commit, sha256)
+
+
+PROJECTS = [
+    GitHubProject('com_google_absl', 'abseil', 'abseil-cpp'),
+    GitHubProject('com_google_googletest', 'google', 'googletest'),
+    GitHubProject('com_github_google_benchmark', 'google', 'benchmark'),
+    GitHubProject('com_github_grpc_grpc', 'grpc', 'grpc'),
+    GitHubProject('com_github_jupp0r_prometheus_cpp', 'jupp0r', 'prometheus-cpp'),
+    GitHubProject('com_github_curl', 'curl', 'curl'),
+    GitHubProject('com_github_tencent_rapidjson', 'Tencent', 'rapidjson'),
+]
+
+for project in PROJECTS:
+  print(project.workspace_rule())